Plans, API keys, team

Account-level concerns: how plans + quotas work, generating and rotating API keys per project, inviting teammates and managing their roles.

Plan tiers

How quotas are enforced

• Captures / month — checked at the ingest endpoint. Hit the limit and Unity gets back 402 QUOTA_EXCEEDED:sessions_per_month. The Unity tool surfaces this in the editor console; the dashboard's Usage page shows it red.
• Projects per org — checked when creating a new project. Hit the limit and you get an inline upgrade prompt.
• Members + pending invites — checked when sending an invite. The team page shows the seat counter prominently (3 / 5 seats used).
• API keys per project — checked at key creation. Pro's 10/project limit is generous; Team is unlimited.

All quotas reset on the 1st of each calendar month except retention (which is enforced continuously by the nightly worker per-capture).

Upgrading / downgrading

From the dashboard, org → Billing opens Stripe Customer Portal. Upgrades take effect immediately + are prorated. Downgrades take effect at period end — your existing data stays, but ingest blocks once you exceed the new tier's limits.

API keys

Every project has its own set of API keys. Unity uses one to authenticate captures; you can have separate keys per build flavour (Dev / Staging / Prod) so revoking one doesn't break the others.

Creating a key

1. Project → API keys tab → New API key.
2. Pick a name (e.g. development, ci-build).
3. Pick permissions:
   • sessions:write — required for Unity to upload captures.
   • sessions:read — only if you're building a custom dashboard or report tool that reads back captures.
   • anomaly:read / anomaly:write — for future programmatic anomaly-rule access. Not needed for v1.
4. Click Generate. The key is shown once on the next screen — copy it now. Format: argus_ followed by 32 hex characters.

Storage: keys are stored as bcrypt hashes (cost 12). The cleartext is unrecoverable. Lost it? Generate a new one and revoke the old.

Rotating a key

Suspect a key leaked, or just want to rotate as part of a security cycle?

1. API keys tab → row → Rotate.
2. A new key is generated and shown once. The old key keeps working for 24 hours — a grace window so you can deploy the new key to your Unity build / CI before the old one stops working.
3. After 24 hours, the old key returns 401 on every request. The dashboard logs the rotation in the audit log with rotated_from_id linking the chain.

Revoking a key

Immediate. Row → Revoke → confirm. The key returns 401 immediately. No grace window.

Use this when you know the key is compromised. For routine rotation, prefer Rotate (it gives you the grace window).

Team management

From the avatar dropdown → Team, or directly at /[orgSlug]/team.

Roles

Inviting a teammate

1. Team page → Invite teammate (top-right).
2. Enter their email + pick a role.
3. Click Invite. They receive an email with a link valid for 7 days. The pending invite shows in the Pending invitations table — you can resend or revoke from there.
4. They click the link, sign up (or log in if already an Argus user), and join the org with the role you picked.

Email-match is enforced — they must accept while logged in as the same email you invited.

Sole-owner protection

The system refuses to remove or demote the last remaining owner of an org with other members — otherwise the org would become unmanageable. Promote someone else to Owner first, then change your own role.

Account deletion + ownership transfer

From Privacy & data, request account deletion. If you're the sole owner of any shared org, the request is rejected — transfer ownership first. Once accepted, deletion fires after a 30-day grace window (cancellable via email link).

Profile + security

See Profile for name, email, password change, resend verification. Security shows active sessions across all your devices, with per-device revoke + a "sign out everywhere except this device" button (preserves the current cookie via server-side hash compare).

Compliance

Argus is GDPR / CCPA / LGPD-aware. Privacy policy lists everything we collect. Account → Privacy & data lets you download your full export (JSON) or schedule deletion. See also sub-processors for the list of vendors who process customer data on our behalf.